This is the accessible text file for GAO report number GAO-13-416R
entitled 'Bureau of the Public Debt: Areas for Improvement in
Information Systems Controls' which was released on May 9, 2013.
This text file was formatted by the U.S. Government Accountability
Office (GAO) to be accessible to users with visual impairments, as
part of a longer term project to improve GAO products' accessibility.
Every attempt has been made to maintain the structural and data
integrity of the original printed product. Accessibility features,
such as text descriptions of tables, consecutively numbered footnotes
placed at the end of the file, and the text of agency comment letters,
are provided but may not exactly duplicate the presentation or format
of the printed version. The portable document format (PDF) file is an
exact electronic replica of the printed version. We welcome your
feedback. Please E-mail your comments regarding the contents or
accessibility features of this document to Webmaster@gao.gov.
This is a work of the U.S. government and is not subject to copyright
protection in the United States. It may be reproduced and distributed
in its entirety without further permission from GAO. Because this work
may contain copyrighted images or other material, permission from the
copyright holder may be necessary if you wish to reproduce this
material separately.
GAO-13-416R:
United States Government Accountability Office:
Washington, DC 20548:
May 9, 2013:
The Honorable David A. Lebryk:
Commissioner:
Bureau of the Fiscal Service:
U.S. Department of the Treasury:
Subject: Bureau of the Public Debt: Areas for Improvement in
Information Systems Controls:
Dear Mr. Lebryk:
In connection with fulfilling our requirement to audit the
consolidated financial statements of the U.S. government,[Footnote 1]
we audited and reported on the Schedules of Federal Debt Managed by
the Bureau of the Public Debt (BPD)[Footnote 2] for the fiscal years
ended September 30, 2012 and 2011.[Footnote 3] As part of these
audits, we performed a review of information systems controls over key
BPD financial systems relevant to the Schedule of Federal Debt.
As we reported in connection with our audit of the Schedules of
Federal Debt for the fiscal years ended September 30, 2012 and 2011,
we concluded that BPD maintained, in all material respects, effective
internal control over financial reporting relevant to the Schedule of
Federal Debt as of September 30, 2012, that provided reasonable
assurance that misstatements, losses, or noncompliance material in
relation to the Schedule of Federal Debt would be prevented, or
detected and corrected, on a timely basis. However, we identified
information systems deficiencies affecting internal control over
financial reporting which, while we do not consider them individually
or collectively to be either material weaknesses or significant
deficiencies, nevertheless warrant the attention and action of
management.[Footnote 4] Furthermore, in late fiscal year 2011, the
Department of the Treasury (Treasury) began consolidating the data
centers and related operations of Treasury's BPD and Financial
Management Service (FMS). Given the significant role that certain
information systems have in managing federal debt, it will be
important that Treasury management assesses risks associated with the
consolidation of the data centers and related operations and ensures
that internal control over the information systems in these data
centers is effectively designed and implemented.
This report presents the deficiencies we identified during our fiscal
year 2012 testing of information systems controls over key BPD
financial systems relevant to the Schedule of Federal Debt. This
report also includes the results of our follow-up on the status of
BPD's corrective actions to address information systems control-
related deficiencies and associated recommendations contained in our
prior years' reports and open as of September 30, 2011. In a
separately issued Limited Official Use Only report, we communicated
detailed information regarding our findings and related
recommendations to the Commissioner of the Bureau of the Fiscal
Service.
We also assessed information systems controls over key financial
systems maintained and operated by the Federal Reserve Banks (FRB) on
behalf of Treasury relevant to the Schedule of Federal Debt. We issued
a separate report to the Board of Governors of the Federal Reserve
System on the results of that assessment.
Results in Brief:
During our fiscal year 2012 audit, we identified four new general
information systems control deficiencies related to access controls
and configuration management. In the Limited Official Use Only report,
we made four recommendations to address these control deficiencies.
None of the control deficiencies we identified represented significant
risks to BPD financial systems. The potential effect of these
deficiencies on the Schedule of Federal Debt financial reporting was
mitigated by BPD's physical security measures and a program of
monitoring user and system activity, as well as compensating
management and reconciliation controls designed to detect potential
misstatements of the Schedule of Federal Debt.
In addition, during our follow-up on the status of BPD's corrective
actions to address information systems control-related deficiencies
and associated recommendations contained in our prior years' reports
and open as of September 30, 2011, we determined that corrective
action was complete for 7 of the 16 open recommendations and
corrective action was in progress for each of the 9 remaining open
recommendations related to access controls, configuration management,
and segregation of duties.
The Commissioner of the Bureau of the Fiscal Service provided comments
on the detailed findings and recommendations in the separately issued
Limited Official Use Only report. In those comments, the Commissioner
stated that, subsequent to September 30, 2012, one of the four new
information systems control-related deficiencies, as well as the
deficiencies associated with two of the nine remaining open
recommendations contained in our prior years' reports, have been
successfully remediated. Additionally, the Commissioner cited planned
corrective actions to address the remaining open information systems
control-related deficiencies.
Background:
Treasury is authorized by Congress to borrow money backed by the full
faith and credit of the United States to fund federal operations.
Treasury is responsible for prescribing the debt instruments and
otherwise limiting and restricting the amount and composition of the
debt. Treasury is also responsible for issuing and redeeming debt
instruments, paying interest to investors, and accounting for the
resulting debt. In addition, Treasury maintains an investment program
for federal government accounts, including trust funds, that have
legislative authority to invest temporary cash reserves not needed for
current benefits and expenses.
As of September 30, 2012 and 2011, federal debt managed by Treasury's
BPD totaled about $16.1 trillion and $14.8 trillion, respectively,
primarily for moneys borrowed to fund the federal government's
operations. These balances consisted of approximately (1) $11.3
trillion and $10.1 trillion of debt held by the public as of September
30, 2012 and 2011, respectively, and (2) $4.8 trillion and $4.7
trillion of intragovernmental debt holdings as of September 30, 2012
and 2011, respectively. Total interest expense on federal debt managed
by BPD for fiscal years 2012 and 2011 was about $432 billion and $454
billion, respectively.
Treasury relies on a number of interconnected financial systems and
electronic data to process and track the money that it borrows and to
account for the securities it issues. Many FRBs provide fiscal agent
services on behalf of Treasury. Such services primarily consist of
issuing, servicing, and redeeming Treasury securities held by the
public and handling the related transfers of funds. FRBs use a number
of key financial systems to process debt-related transactions.
Detailed data initially processed at FRBs are summarized and then
forwarded electronically to the appropriate Treasury data center for
matching, verification, and posting to the general ledger.
General information systems controls are the structure, policies, and
procedures that apply to an entity's overall computer operations.
General information systems controls establish the environment in
which the application systems and controls operate. They include five
general control areas--security management, access controls,
configuration management, segregation of duties, and contingency
planning.[Footnote 5] An effective general information systems control
environment (1) provides a framework and continuing cycle of activity
for managing risk, developing security policies, assigning
responsibilities, and monitoring the adequacy of the entity's computer-
related controls (security management); (2) limits or detects access
to computer resources such as data, programs, equipment, and
facilities, thereby protecting them against unauthorized modification,
loss, and disclosure (access controls); (3) prevents unauthorized
changes to information system resources, such as software programs and
hardware configurations, and provides reasonable assurance that
systems are configured and operating securely and as intended
(configuration management); (4) includes policies, procedures, and an
organizational structure to manage who can control key aspects of
computer-related operations (segregation of duties); and (5) protects
critical and sensitive data, and provides for critical operations to
continue without disruption or be promptly resumed when unexpected
events occur (contingency planning).
Objectives, Scope, and Methodology:
Our objectives were to evaluate information systems controls over key
financial systems maintained and operated by, and on behalf of,
Treasury that are relevant to the Schedule of Federal Debt, and to
determine the status of BPD's corrective actions to address
information systems control-related deficiencies and associated
recommendations in our prior years' reports for which actions were not
complete as of September 30, 2011. Our evaluation of information
systems controls was conducted using the Federal Information System
Controls Audit Manual.[Footnote 6]
To evaluate information systems controls, we identified and reviewed
BPD's information systems control policies and procedures, observed
controls in operation, conducted tests of controls, and held
discussions with officials at the appropriate Treasury data center to
determine whether controls were adequately designed, implemented, and
operating effectively.
The scope of our general information systems controls work for fiscal
year 2012 included:
(1) following up on open recommendations from our prior years' reports
and (2) using a risk-based approach to testing the five general
control areas related to the systems in which the applications operate
and other critical control points in the systems or networks that
could have an impact on the effectiveness of the information systems
controls at BPD in the current year. In addition, we assessed software
and network security by reviewing vulnerability scans over key BPD
financial systems relevant to the Schedule of Federal Debt.
We determined whether relevant application controls were appropriately
designed and implemented, and then performed tests to determine
whether the application controls were operating effectively. We
reviewed six key BPD applications relevant to the Schedule of Federal
Debt to determine whether the application controls were designed and
operating effectively to provide reasonable assurance that:
* all transactions that occurred were input into the system, accepted
for processing, processed once and only once by the system, and
properly included in output;
* transactions were properly recorded in the proper period, key data
elements input for transactions were accurate, data elements were
processed accurately by applications that produce reliable results,
and output was accurate;
* all recorded transactions actually occurred, were related to the
organization, and were properly approved in accordance with
management's authorization, and output contained only valid data;
* application data and reports and other output were protected against
unauthorized access; and:
* application data and reports and other relevant business information
were readily available to users when needed.
We also reviewed the application information systems control audit
documentation from the work performed by the Treasury Office of
Inspector General's contractor on two other key BPD applications. In
addition, we performed additional procedures related to the
segregation of duties between users of a key FMS application and users
of a key BPD application. We performed these additional procedures in
response to Treasury's ongoing initiative to consolidate the data
centers and related operations of BPD and FMS.
Because FRBs are integral to the processing of federal debt
transactions, we also evaluated information systems controls over key
financial systems maintained and operated by FRBs on behalf of
Treasury that are relevant to the Schedule of Federal Debt, and
determined the status of FRBs' corrective actions to address
information systems control-related deficiencies and associated
recommendations contained in our prior years' reports for which
actions were not complete as of September 30, 2011. This included
using a risk-based approach to testing the five general control areas
related to the systems in which the applications operate and other
critical control points in the systems or networks that could have an
impact on the effectiveness of the information systems controls at the
relevant FRBs. We also evaluated the relevant application controls
over four applications maintained and operated by FRBs.
The independent public accounting (IPA) firm of Cotton & Company LLP
evaluated and tested certain BPD information systems controls,
including the follow-up on the status of BPD's corrective actions
during fiscal year 2012 to address open recommendations from our prior
years' reports. We agreed on the scope of the audit work, monitored
the IPA firm's progress, and reviewed the related audit documentation
to determine whether the firm's findings were adequately supported.
During the course of our work, we communicated our findings to BPD
management. We plan to follow up to determine the status of corrective
actions taken for matters open as of September 30, 2012, during our
audit of the fiscal year 2013 Schedule of Federal Debt.
We performed our work in accordance with U.S. generally accepted
government auditing standards. We believe that our audit provided a
reasonable basis for our conclusions in this report.
As noted above, we obtained agency comments on the detailed findings
and recommendations in a draft of the separately issued Limited
Official Use Only report. The Commissioner of the Bureau of the Fiscal
Service's comments are summarized in the Agency Comments and Our
Evaluation section of this report.
Assessment of BPD's Information Systems Controls:
During our fiscal year 2012 testing, we identified opportunities to
strengthen certain information systems controls that support key BPD
financial systems relevant to the Schedule of Federal Debt.
Specifically, we identified four new general information systems
control deficiencies related to access controls and configuration
management. We considered these deficiencies in determining that there
was not a material weakness or significant deficiency in internal
control over financial reporting relevant to the Schedule of Federal
Debt.
Access controls are important because they limit access or detect
inappropriate access to computer resources (data, equipment, and
facilities), thereby protecting them from unauthorized modification,
loss, and/or disclosure. Such controls include logical access controls
and physical access controls. The new access control deficiencies we
identified during fiscal year 2012 related to logical access controls.
Effectively designed and implemented logical access controls require
users to authenticate themselves through the use of passwords or other
identifiers, and limit the files and other resources that
authenticated users can access and the actions that they can execute
based on a valid need that is determined by assigned official duties.
Configuration management is important because it involves the
identification and management of security features for all hardware,
software, and firmware components of an information system at a given
point and systematically controls changes to that configuration during
the system's life cycle. Effectively designed and implemented
configuration management controls provide reasonable assurance that
only authorized and fully tested changes are made to critical
components at each system sublevel (i.e., network, operating systems,
and infrastructure applications). In addition, effectively designed
and implemented configuration management controls provide reasonable
assurance that applications and changes to the applications go through
a formal, documented systems development process that identifies all
changes to the baseline configuration. To help ensure that changes to
applications are necessary, work as intended, and do not result in the
loss of data or program integrity, such changes should be documented,
authorized, tested, and independently reviewed.
In a separately issued Limited Official Use Only report, we
communicated to the Commissioner of the Bureau of the Fiscal Service
detailed information regarding the four new general information
systems control deficiencies and made four recommendations to address
these control deficiencies.
In addition, our fiscal year 2012 follow-up on the status of actions
taken by BPD to address previously identified, but unresolved, general
information systems control deficiencies as of September 30, 2011,
found that corrective action was complete for 7 of the 16 open
recommendations and corrective action was in progress for each of the
9 remaining open recommendations related to access controls,
configuration management, and segregation of duties.
None of the control deficiencies we identified represented significant
risks to BPD financial systems. The potential effect of these
deficiencies on the Schedule of Federal Debt financial reporting was
mitigated by BPD's physical security measures and a program of
monitoring user and system activity, as well as compensating
management and reconciliation controls designed to detect potential
misstatements of the Schedule of Federal Debt. Nevertheless, these
deficiencies increase the risk of unauthorized access, loss,
modification, or disclosure of sensitive data and programs and
disruption of critical operations and, therefore, warrant the
attention and action of management.
Agency Comments and Our Evaluation:
The Commissioner of the Bureau of the Fiscal Service provided comments
on the detailed findings and recommendations in the separately issued
Limited Official Use Only report. In those comments, the Commissioner
stated that, subsequent to September 30, 2012, one of the four new
information systems control-related deficiencies has been successfully
remediated and that corrective actions to address the remaining three
are expected to be complete by June 2013. Additionally, the
Commissioner stated that, subsequent to September 30, 2012, the
information systems control-related deficiencies associated with two
of the nine remaining open recommendations from our prior years'
reports have been successfully remediated. The Commissioner further
stated that corrective actions to address the seven remaining open
recommendations are expected to be complete by September 2013. We plan
to follow up to determine the status of corrective actions taken to
address the deficiencies open as of September 30, 2012, during our
audit of the fiscal year 2013 Schedule of Federal Debt.
In the separately issued Limited Official Use Only report, we noted
that the head of a federal agency is required by 31 U.S.C. § 720 to
submit a written statement on actions taken on our recommendations to
the Senate Committee on Homeland Security and Governmental Affairs and
to the House Committee on Oversight and Government Reform not later
than 60 days after the date of the Limited Official Use Only report. A
written statement must also be sent to the Senate and House Committees
on Appropriations with the agency's first request for appropriations
made more than 60 days after the date of that report. In the Limited
Official Use Only report, we also requested a copy of your responses.
We are sending copies of this report to interested congressional
committees, the Secretary of the Treasury, the Inspector General of
the Department of the Treasury, and the Director of the Office of
Management and Budget. In addition, this report is available at no
charge on the GAO website at [hyperlink, http://www.gao.gov].
If you have any questions regarding this report, please contact me at
(202) 512-3406 or engelg@gao.gov. Contact points for our Offices of
Congressional Relations and Public Affairs may be found on the last
page of this report. GAO staff members who made major contributions to
this report include Dianne D. Guensberg, David B. Hayes, Jeffrey L.
Knott, and Dawn B. Simpson (Assistant Directors); Nicole M. Burkart;
Dean D. Carpenter; Kristi C. Dorsey; and Seong Bin Park.
Sincerely yours,
Signed by:
Gary T. Engel:
Director:
Financial Management and Assurance:
[End of section]
Footnotes:
[1] 31 U.S.C. § 331(e)(2). Federal debt and related activity and
balances managed by BPD during fiscal years 2012 and 2011 were also
significant to the consolidated financial statements of the Department
of the Treasury (see 31 U.S.C. § 3515(b)).
[2] According to Department of the Treasury officials, on October 7,
2012, the Secretary of the Treasury
(1) established the Bureau of the Fiscal Service as a bureau within
the Department of the Treasury,
(2) consolidated and redesignated BPD and the Financial Management
Service as the Bureau of the Fiscal Service, and (3) transferred the
duties of the BPD and Financial Management Service commissioners to
the Commissioner of the Bureau of the Fiscal Service. We are
addressing the report and new recommendations being made to the
Commissioner of the Bureau of the Fiscal Service. Elsewhere in this
report, we refer to BPD, which was responsible for managing the
Schedules of Federal Debt when we performed our audit work in prior
years.
[3] GAO, Financial Audit: Bureau of the Public Debt's Fiscal Years
2012 and 2011 Schedules of Federal Debt, [hyperlink,
http://www.gao.gov/products/GAO-13-114] (Washington, D.C.: Nov. 8,
2012).
[4] A material weakness is a deficiency, or a combination of
deficiencies, in internal control, such that there is a reasonable
possibility that a material misstatement of the entity's financial
statements will not be prevented, or detected and corrected, on a
timely basis. A significant deficiency is a deficiency, or a
combination of deficiencies, in internal control that is less severe
than a material weakness yet important enough to merit attention by
those charged with governance. A deficiency in internal control exists
when the design or operation of a control does not allow management or
employees, in the normal course of performing their assigned
functions, to prevent, or detect and correct, misstatements on a
timely basis.
[5] GAO, Government Auditing Standards, [hyperlink,
http://www.gao.gov/products/GAO-07-731G] (Washington, D.C.: July
2007). The July 2007 revision of Government Auditing Standards has
been superseded by the December 2011 revision, GAO, Government
Auditing Standards, [hyperlink,
http://www.gao.gov/products/GAO-12-331G] (Washington, D.C.: December
2011). However, the July 2007 revision is cited here because this
version was effective for our audit of the Schedules of Federal Debt
Managed by BPD for the fiscal years ended September 30, 2012 and 2011.
[6] GAO, Federal Information System Controls Audit Manual, [hyperlink,
http://www.gao.gov/products/GAO-09-232G] (Washington, D.C.: February
2009).
[End of section]
GAO’s Mission:
The Government Accountability Office, the audit, evaluation, and
investigative arm of Congress, exists to support Congress in meeting
its constitutional responsibilities and to help improve the
performance and accountability of the federal government for the
American people. GAO examines the use of public funds; evaluates
federal programs and policies; and provides analyses, recommendations,
and other assistance to help Congress make informed oversight, policy,
and funding decisions. GAO’s commitment to good government is
reflected in its core values of accountability, integrity, and
reliability.
Obtaining Copies of GAO Reports and Testimony:
The fastest and easiest way to obtain copies of GAO documents at no
cost is through GAO’s website [hyperlink, http://www.gao.gov]. Each
weekday afternoon, GAO posts on its website newly released reports,
testimony, and correspondence. To have GAO e-mail you a list of newly
posted products, go to [hyperlink, http://www.gao.gov] and select
“E-mail Updates.”
Order by Phone:
The price of each GAO publication reflects GAO’s actual cost of
production and distribution and depends on the number of pages in the
publication and whether the publication is printed in color or black
and white. Pricing and ordering information is posted on GAO’s
website, [hyperlink, http://www.gao.gov/ordering.htm].
Place orders by calling (202) 512-6000, toll free (866) 801-7077, or
TDD (202) 512-2537.
Orders may be paid for using American Express, Discover Card,
MasterCard, Visa, check, or money order. Call for additional
information.
Connect with GAO:
Connect with GAO on facebook, flickr, twitter, and YouTube.
Subscribe to our RSS Feeds or E mail Updates. Listen to our Podcasts.
Visit GAO on the web at [hyperlink, http://www.gao.gov].
To Report Fraud, Waste, and Abuse in Federal Programs:
Contact:
Website: [hyperlink, http://www.gao.gov/fraudnet/fraudnet.htm];
E-mail: fraudnet@gao.gov;
Automated answering system: (800) 424-5454 or (202) 512-7470.
Congressional Relations:
Katherine Siggerud, Managing Director, siggerudk@gao.gov:
(202) 512-4400:
U.S. Government Accountability Office:
441 G Street NW, Room 7125:
Washington, DC 20548.
Public Affairs:
Chuck Young, Managing Director, youngc1@gao.gov:
(202) 512-4800:
U.S. Government Accountability Office:
441 G Street NW, Room 7149:
Washington, DC 20548.
[End of document]